CVE-2026-63999

Summary

In the Linux kernel, the following vulnerability has been resolved:

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux4f038a6a02d20859a3479293cbf172b0f14cbdd6 < 33d05c22d6f227c5ae171c46df2f6f8bf48047eaaffected
LinuxLinux4f038a6a02d20859a3479293cbf172b0f14cbdd6 < 80d95d92f828cfcace955d673637d944178b435faffected
LinuxLinux4f038a6a02d20859a3479293cbf172b0f14cbdd6 < 266297692f97008ca48bc311775c087c59bd7fe3affected
LinuxLinux81a5174e64ce4fb7b7a2f6499b835c904c9451eeaffected
LinuxLinuxec9faff49a4ea27731de39cb887b7e590e93157baffected
LinuxLinuxc5ed0eaddcbda56079091fc3876b140a6e70a548affected
LinuxLinuxa065b996052656a65afc51ad82336dc55ae4c72faffected
LinuxLinuxadee9db710a6117b978a25ed4153846b7c56ec9aaffected
LinuxLinux5eb3fdc4b6281b29e830300c866a36d90442b1f0affected
LinuxLinux5.15.181 < 5.16affected
LinuxLinux6.1.135 < 6.2affected
LinuxLinux6.6.88 < 6.7affected
LinuxLinux6.12.24 < 6.13affected
LinuxLinux6.13.12 < 6.14affected
LinuxLinux6.14.3 < 6.15affected
LinuxLinux6.15affected
LinuxLinux0 < 6.15unaffected
LinuxLinux6.18.35 <= 6.18.*unaffected
LinuxLinux7.0.12 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References